We evaluated Marvolo using the recent MalConv [1]} malware detector and multiple commercially-available large/small-scale datasets, i.e., the large-scale Ember [2]} dataset, as well as a small-scale Brazilian dataset [3]}. Overall, we find that Marvolo boosts MalConv's accuracies by up to 6%, with most wins coming from accurately detecting previously unseen binary families – such scenarios are intuitively more difficult to catch, but are the primary goal of any malware detection system, highlighting the practical utility of Marvolo. Further, relative to performing straightforward code transformations, Marvolo's optimizations enable MalConv to reap these benefits while operating on 85% fewer binaries (resulting in speedups of 79\(\times \) ). We will open-source Marvolo post-publication.
